On Saturday, 13 June 2026 16:55:49 CEST Christian Schoenebeck wrote:
> This series adds a limit on the number of simultaneously open xattr FIDs
> in QEMU's 9p filesystem server to prevent host memory exhaustion attacks.
>
> The Txattrcreate 9p request creates FIDs for extended attribute operations.
> Each xattr FID contains a buffer for the xattr value. Without a limit, a
> malicious priviliged guest with direct communication access to 9p server
> could create a huge number of xattr FIDs, leading to potential host memory
> exhaustion (DoS, potentially affecting other services on host).
>
> Overview Patches:
>
> - Patch 1 is the core fix that limits the amount of xattr FIDs to 1024.
>
> - Patch 2 adds option "max_xattr" allowing to override the default value.
>
> - Patch 3 updates QEMU documentation with this new option.
>
> - All other patches are basically just test case changes that guard
> correct behaviour of this new limit.
I just appended git log comments of patches 11 and 12 to make it clear that
these are slow tests (-m slow), not running by default.
Queued on 9p.next:
https://github.com/cschoenebeck/qemu/commits/9p.next
Thanks!
/Christian
> v3:
> - Patch 12: Fix one memory leak.
> - Fix more typos in commit logs of several patches.
>
> v2:
> - Patch 1:
> - Add error_report_once() call when limit is exceeded.
> - Fix typos in comments.
> - Patch 3:
> - Fix option description being pasted to wrong paragraph.
> - Minor rephrasing.
>
> Christian Schoenebeck (12):
> hw/9pfs: add xattr FID limit to prevent memory exhaustion
> hw/9pfs: add max_xattr option
> qemu-options: document 9pfs max_xattr option
> tests/9p: add Tread / Rread test client functions
> tests/9p: add Tclunk / Rclunk test client functions
> tests/9p: add Txattrcreate / Rxattrcreate test client functions
> hw/9pfs: enable xattr (mockup) support for synth fs driver
> hw/9pfs: add xattr count query interface to fs synth driver
> tests/9p: increase P9_MAX_SIZE for test client
> tests/9p: add virtio_9p_add_synth_driver_args() test client function
> tests/9p: add 3 xattr FID limit test cases (synth fs driver)
> tests/9p: add 3 xattr FID limit test cases (local fs driver)
>
> fsdev/file-op-9p.h | 11 ++
> fsdev/qemu-fsdev-opts.c | 6 +
> fsdev/qemu-fsdev.c | 2 +-
> hw/9pfs/9p-local.c | 9 +
> hw/9pfs/9p-synth.c | 51 ++++-
> hw/9pfs/9p.c | 62 ++++++
> qemu-options.hx | 28 ++-
> system/vl.c | 7 +-
> tests/qtest/libqos/virtio-9p-client.c | 124 ++++++++++++
> tests/qtest/libqos/virtio-9p-client.h | 88 ++++++++-
> tests/qtest/libqos/virtio-9p.c | 6 +
> tests/qtest/libqos/virtio-9p.h | 6 +
> tests/qtest/virtio-9p-test.c | 262 +++++++++++++++++++++++++-
> 13 files changed, 643 insertions(+), 19 deletions(-)